WIP: chore(next): update the web next based on v6.11.0

.cursor/rules/testing-approach.mdc

@@ -24,6 +24,17 @@ Matters Web uses a combination of unit, component, and end-to-end (E2E) tests.
 - `npm run test:e2e`: Run end-to-end tests
 - `npm run test:unit:coverage`: Generate coverage report
 
+## Release Evaluation Boundary
+
+Use the shared release evaluation standard when testing feature launches:
+
+- Preview and PR checks should use the Vercel preview URL through `PLAYWRIGHT_TEST_BASE_URL`.
+- `matters.icu` is the staging acceptance target and may use disposable test data.
+- `matters.town` production checks are read-only by default; production mutations, admin actions, payment actions, moderation changes, or outbound delivery require explicit human approval.
+- Keep CI status, staging acceptance, production deployment, and production smoke-test results separate.
+
+See [docs/e2e-release-evaluation.md](mdc:docs/e2e-release-evaluation.md) for the repo-local guide.
+
 ## Testing Utilities
 
 - Mock data and fixtures for testing

.env.dev

@@ -19,22 +19,23 @@ NEXT_PUBLIC_OAUTH_URL=https://server.matters.icu/oauth
 NEXT_PUBLIC_SEGMENT_KEY=3gE20MjzN9qncFqlKV0pDvNO7Cp2gWU3
 NEXT_PUBLIC_FB_APP_ID=823885921293850
 NEXT_PUBLIC_WALLETCONNECT_ID=e7fc7d3ee120ec6611ea433a5bbb6613
-NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5eed3e45bb994886b10e23fba64b160b
-NEXT_PUBLIC_SENTRY_PROJECT_ID=6105556
-NEXT_PUBLIC_SENTRY_DOMAIN=o1089931.ingest.us.sentry.io
+NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5c35ff1ac0c7d9d8513ebbbb540c5dee
+NEXT_PUBLIC_SENTRY_PROJECT_ID=4510956654100480
+NEXT_PUBLIC_SENTRY_DOMAIN=o4507972688478208.ingest.us.sentry.io
 NEXT_PUBLIC_FIREBASE_CONFIG=eyJhcGlLZXkiOiJBSXphU3lESnR4N0hZOVIxbFdNX3J0SXRwRV9jM090c3VlYVhJa28iLCJhdXRoRG9tYWluIjoibWF0dGVycy1pY3UuZmlyZWJhc2VhcHAuY29tIiwicHJvamVjdElkIjoibWF0dGVycy1pY3UiLCJzdG9yYWdlQnVja2V0IjoibWF0dGVycy1pY3UuZmlyZWJhc2VzdG9yYWdlLmFwcCIsIm1lc3NhZ2luZ1NlbmRlcklkIjoiMTI5MDg3ODY3MjgyIiwiYXBwSWQiOiIxOjEyOTA4Nzg2NzI4Mjp3ZWI6NTc3MGI1YzY5YjFiYTdjYzNjMTk0YiIsIm1lYXN1cmVtZW50SWQiOiJHLTY2VkpQRTlHMlAifQ==
 NEXT_PUBLIC_STRIPE_PUBLIC_KEY=pk_test_51GrOGRCE0HD6LY9Uo7rK3pSmiIG4KTjWO1rOrJavFFJob3zQlSjZg6uavIhcGbp8o1wZGcEuph2MgUfHhsB48vx000z2S0FiUx
 NEXT_PUBLIC_TRAVELOGGERS_URL=https://nft-develop.matters.town
 NEXT_PUBLIC_LOGBOOKS_URL=https://logbooks-vercel.matters.town
-NEXT_PUBLIC_ALCHEMY_KEY=1dMo8xjAFo8M6Y4sQ45WTD3Zie2-MA4C
+NEXT_PUBLIC_ALCHEMY_KEY=Cl3ezSQsRJ0EpAj8ar1WM
 NEXT_PUBLIC_GOOGLE_CLIENT_ID=315393900359-2r9fundftis7dc0tdeo2hf8630nfdd8h.apps.googleusercontent.com
 NEXT_PUBLIC_TWITTER_CLIENT_ID=X3d6Szg5bnVCMm5wRWxSVmhXUTc6MTpjaQ
+NEXT_PUBLIC_THREADS_CLIENT_ID=1547288284064903
 NEXT_PUBLIC_CF_TURNSTILE_SITE_KEY=0x4AAAAAAAKiedvR5qiLUhIs
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK=/@rsdyobw/22048-launching-the-nomad-matters-initiative
 NEXT_PUBLIC_CAMPAIGN_APPLICATION_LINK=https://docs.google.com/forms/d/e/1FAIpQLSeQzWJ8g2fZk5a9DD-1P_Y4pyQCTE1cbTI6T8-5K8PQXAZ6pA/viewform?usp=dialog
 NEXT_PUBLIC_BILLBOARD_OPERATOR_ADDRESS=0xBcEAD54De463C083F348b530305e2471652D59A3
 NEXT_PUBLIC_BILLBOARD_REGISTRY_ADDRESS=0xEb23327533aa993069D61b8E1d6001B1cce0E216
 NEXT_PUBLIC_BILLBOARD_TOKEN_ID=1
 NEXT_PUBLIC_BILLBOARD_IMAGE_URL=matters-billboard-ad-dev.s3.ap-southeast-1.amazonaws.com/
-SENTRY_ORG=matters-lab
+SENTRY_ORG=firefly-uz
 SENTRY_PROJECT=matters-web-develop

.env.local.example

@@ -19,20 +19,20 @@ NEXT_PUBLIC_OAUTH_URL=https://server.matters.icu/oauth
 NEXT_PUBLIC_SEGMENT_KEY=3gE20MjzN9qncFqlKV0pDvNO7Cp2gWU3
 NEXT_PUBLIC_FB_APP_ID=823885921293850
 NEXT_PUBLIC_WALLETCONNECT_ID=e7fc7d3ee120ec6611ea433a5bbb6613
-NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5eed3e45bb994886b10e23fba64b160b
-NEXT_PUBLIC_SENTRY_PROJECT_ID=6105556
-NEXT_PUBLIC_SENTRY_DOMAIN=o1089931.ingest.us.sentry.io
+NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5c35ff1ac0c7d9d8513ebbbb540c5dee
+NEXT_PUBLIC_SENTRY_PROJECT_ID=4510956654100480
+NEXT_PUBLIC_SENTRY_DOMAIN=o4507972688478208.ingest.us.sentry.io
 NEXT_PUBLIC_FIREBASE_CONFIG=eyJhcGlLZXkiOiJBSXphU3lESnR4N0hZOVIxbFdNX3J0SXRwRV9jM090c3VlYVhJa28iLCJhdXRoRG9tYWluIjoibWF0dGVycy1pY3UuZmlyZWJhc2VhcHAuY29tIiwicHJvamVjdElkIjoibWF0dGVycy1pY3UiLCJzdG9yYWdlQnVja2V0IjoibWF0dGVycy1pY3UuZmlyZWJhc2VzdG9yYWdlLmFwcCIsIm1lc3NhZ2luZ1NlbmRlcklkIjoiMTI5MDg3ODY3MjgyIiwiYXBwSWQiOiIxOjEyOTA4Nzg2NzI4Mjp3ZWI6NTc3MGI1YzY5YjFiYTdjYzNjMTk0YiIsIm1lYXN1cmVtZW50SWQiOiJHLTY2VkpQRTlHMlAifQ==
 NEXT_PUBLIC_STRIPE_PUBLIC_KEY=pk_test_51GrOGRCE0HD6LY9Uo7rK3pSmiIG4KTjWO1rOrJavFFJob3zQlSjZg6uavIhcGbp8o1wZGcEuph2MgUfHhsB48vx000z2S0FiUx
 NEXT_PUBLIC_TRAVELOGGERS_URL=https://nft-develop.matters.town
 NEXT_PUBLIC_LOGBOOKS_URL=https://logbooks-vercel.matters.town
-NEXT_PUBLIC_ALCHEMY_KEY=1dMo8xjAFo8M6Y4sQ45WTD3Zie2-MA4C
+NEXT_PUBLIC_ALCHEMY_KEY=Cl3ezSQsRJ0EpAj8ar1WM
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK=/@rsdyobw/22048-launching-the-nomad-matters-initiative
 NEXT_PUBLIC_CAMPAIGN_APPLICATION_LINK=https://docs.google.com/forms/d/e/1FAIpQLSeQzWJ8g2fZk5a9DD-1P_Y4pyQCTE1cbTI6T8-5K8PQXAZ6pA/viewform?usp=dialog
 NEXT_PUBLIC_BILLBOARD_ADDRESS=0x6a72820E1CCCba1B1FE02E37881cEa3F9Aa6375C
 NEXT_PUBLIC_BILLBOARD_TOKEN_ID=6
 NEXT_PUBLIC_BILLBOARD_IMAGE_URL=matters-billboard-ad-dev.s3.ap-southeast-1.amazonaws.com/
-SENTRY_ORG=matters-lab
+SENTRY_ORG=firefly-uz
 SENTRY_PROJECT=matters-web-develop
 PLAYWRIGHT_RUNTIME_ENV=local
 PLAYWRIGHT_TEST_BASE_URL=https://matters.icu

.env.prod

@@ -19,23 +19,24 @@ NEXT_PUBLIC_OAUTH_URL=https://server.matters.town/oauth
 NEXT_PUBLIC_SEGMENT_KEY=Yk2ao5JvhOCyvCh9SCVBT1iTN4kfTpy7
 NEXT_PUBLIC_FB_APP_ID=1415638158583454
 NEXT_PUBLIC_WALLETCONNECT_ID=e7fc7d3ee120ec6611ea433a5bbb6613
-NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5af839b6d42044548d8ec70f00af8c10
-NEXT_PUBLIC_SENTRY_PROJECT_ID=6153512
-NEXT_PUBLIC_SENTRY_DOMAIN=o1089931.ingest.us.sentry.io
+NEXT_PUBLIC_SENTRY_PUBLIC_KEY=6ba18c87f395dd836e1c479f2c9004f2
+NEXT_PUBLIC_SENTRY_PROJECT_ID=4510956671467520
+NEXT_PUBLIC_SENTRY_DOMAIN=o4507972688478208.ingest.us.sentry.io
 NEXT_PUBLIC_FIREBASE_CONFIG=eyJhcGlLZXkiOiJBSXphU3lEajFCV2tNa2tpaXdYYkpOQUFtSFVWX3hjVGZrRnQxWGciLCJhdXRoRG9tYWluIjoibWF0dGVycy0yZGQ3OC5maXJlYmFzZWFwcC5jb20iLCJkYXRhYmFzZVVSTCI6Imh0dHBzOi8vbWF0dGVycy0yZGQ3OC5maXJlYmFzZWlvLmNvbSIsInByb2plY3RJZCI6Im1hdHRlcnMtMmRkNzgiLCJzdG9yYWdlQnVja2V0IjoibWF0dGVycy0yZGQ3OC5hcHBzcG90LmNvbSIsIm1lc3NhZ2luZ1NlbmRlcklkIjoiNzE3MTM1MDcyNTcwIiwiYXBwSWQiOiIxOjcxNzEzNTA3MjU3MDp3ZWI6ODJjNWYwNjk0MmMwMjBkYThkZDQwMyIsIm1lYXN1cmVtZW50SWQiOiJHLU05VDM2MTRRSzEifQ
 NEXT_PUBLIC_STRIPE_PUBLIC_KEY=pk_live_NfdCmUIPzQxKEMjLkInsjULK00W7AXBBrG
 NEXT_PUBLIC_TRAVELOGGERS_URL=https://traveloggers.matters.town
 NEXT_PUBLIC_LOGBOOKS_URL=https://logbook.matters.town
-NEXT_PUBLIC_ALCHEMY_KEY=bOu-fCphi9mvePsxg968Qe-pidHQNdlT
+NEXT_PUBLIC_ALCHEMY_KEY=Co-LZNZhG6kpgtIKsXGY7
 NEXT_PUBLIC_CF_TURNSTILE_SITE_KEY=0x4AAAAAAAKVODkJMwfIxG78
 NEXT_PUBLIC_GOOGLE_CLIENT_ID=751677068109-rkml7q9ujf8ems09cclh7qckf14svcgs.apps.googleusercontent.com
 NEXT_PUBLIC_TWITTER_CLIENT_ID=cmdKbUlyd1ZZZDZYa3dTampidGo6MTpjaQ
+NEXT_PUBLIC_THREADS_CLIENT_ID=
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK_EN=/@hi176/476405-a-guide-to-invite
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK=/@hi176/476404
 NEXT_PUBLIC_CAMPAIGN_APPLICATION_LINK=https://docs.google.com/forms/d/e/1FAIpQLSeQzWJ8g2fZk5a9DD-1P_Y4pyQCTE1cbTI6T8-5K8PQXAZ6pA/viewform?usp=dialog
 NEXT_PUBLIC_BILLBOARD_OPERATOR_ADDRESS=0x92a117aeA74963Cd0CEdF9C50f99435451a291F7
 NEXT_PUBLIC_BILLBOARD_REGISTRY_ADDRESS=0x95bEFe8E08a56dCEBBa8d40BE3e9c3cb2fF81806
 NEXT_PUBLIC_BILLBOARD_TOKEN_ID=1
 NEXT_PUBLIC_BILLBOARD_IMAGE_URL=matters-billboard-ad.s3.ap-southeast-1.amazonaws.com/
-SENTRY_ORG=matters-lab
+SENTRY_ORG=firefly-uz
 SENTRY_PROJECT=matters-web-prod

.env.prod-next

@@ -19,17 +19,18 @@ NEXT_PUBLIC_OAUTH_URL=https://server.matters.town/oauth
 NEXT_PUBLIC_SEGMENT_KEY=Yk2ao5JvhOCyvCh9SCVBT1iTN4kfTpy7
 NEXT_PUBLIC_FB_APP_ID=1415638158583454
 NEXT_PUBLIC_WALLETCONNECT_ID=e7fc7d3ee120ec6611ea433a5bbb6613
-NEXT_PUBLIC_SENTRY_PUBLIC_KEY=5af839b6d42044548d8ec70f00af8c10
-NEXT_PUBLIC_SENTRY_PROJECT_ID=6153512
-NEXT_PUBLIC_SENTRY_DOMAIN=o1089931.ingest.us.sentry.io
+NEXT_PUBLIC_SENTRY_PUBLIC_KEY=6ba18c87f395dd836e1c479f2c9004f2
+NEXT_PUBLIC_SENTRY_PROJECT_ID=4510956671467520
+NEXT_PUBLIC_SENTRY_DOMAIN=o4507972688478208.ingest.us.sentry.io
 NEXT_PUBLIC_FIREBASE_CONFIG=eyJhcGlLZXkiOiJBSXphU3lEajFCV2tNa2tpaXdYYkpOQUFtSFVWX3hjVGZrRnQxWGciLCJhdXRoRG9tYWluIjoibWF0dGVycy0yZGQ3OC5maXJlYmFzZWFwcC5jb20iLCJkYXRhYmFzZVVSTCI6Imh0dHBzOi8vbWF0dGVycy0yZGQ3OC5maXJlYmFzZWlvLmNvbSIsInByb2plY3RJZCI6Im1hdHRlcnMtMmRkNzgiLCJzdG9yYWdlQnVja2V0IjoibWF0dGVycy0yZGQ3OC5hcHBzcG90LmNvbSIsIm1lc3NhZ2luZ1NlbmRlcklkIjoiNzE3MTM1MDcyNTcwIiwiYXBwSWQiOiIxOjcxNzEzNTA3MjU3MDp3ZWI6ODJjNWYwNjk0MmMwMjBkYThkZDQwMyIsIm1lYXN1cmVtZW50SWQiOiJHLU05VDM2MTRRSzEifQ
 NEXT_PUBLIC_STRIPE_PUBLIC_KEY=pk_live_NfdCmUIPzQxKEMjLkInsjULK00W7AXBBrG
 NEXT_PUBLIC_TRAVELOGGERS_URL=https://traveloggers.matters.town
 NEXT_PUBLIC_LOGBOOKS_URL=https://logbook.matters.town
-NEXT_PUBLIC_ALCHEMY_KEY=bOu-fCphi9mvePsxg968Qe-pidHQNdlT
+NEXT_PUBLIC_ALCHEMY_KEY=Co-LZNZhG6kpgtIKsXGY7
 NEXT_PUBLIC_CF_TURNSTILE_SITE_KEY=0x4AAAAAAAKVODkJMwfIxG78
 NEXT_PUBLIC_GOOGLE_CLIENT_ID=751677068109-rkml7q9ujf8ems09cclh7qckf14svcgs.apps.googleusercontent.com
 NEXT_PUBLIC_TWITTER_CLIENT_ID=cmdKbUlyd1ZZZDZYa3dTampidGo6MTpjaQ
+NEXT_PUBLIC_THREADS_CLIENT_ID=
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK_EN=/@hi176/476405-a-guide-to-invite
 NEXT_PUBLIC_NOMAD_MATTERS_CAMPAIGN_LINK=/@hi176/476404
 NEXT_PUBLIC_CAMPAIGN_APPLICATION_LINK=https://docs.google.com/forms/d/e/1FAIpQLSeQzWJ8g2fZk5a9DD-1P_Y4pyQCTE1cbTI6T8-5K8PQXAZ6pA/viewform?usp=dialog
@@ -40,5 +41,5 @@ NEXT_PUBLIC_BILLBOARD_IMAGE_URL=matters-billboard-ad.s3.ap-southeast-1.amazonaws
 NEXT_PUBLIC_SITE_DOMAIN=web-next.matters.town
 NEXT_PUBLIC_ADMIN_VIEW=true
 
-SENTRY_ORG=matters-lab
+SENTRY_ORG=firefly-uz
 SENTRY_PROJECT=matters-web-prod

.github/workflows/deploy.yml

@@ -18,7 +18,7 @@ env:
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
-  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN_V2 }}
 
 jobs:
   build_and_deploy:
@@ -118,7 +118,7 @@ jobs:
       - name: Generate deployment package
         if: github.base_ref == 'develop' || github.base_ref == 'master' || github.base_ref == 'main' || github.base_ref == 'release/next'
         run: |
-          zip -r --symlinks deploy.zip . -x .git/\* node_modules/\*
+          zip -r --symlinks deploy.zip . -x .git/\* node_modules/\* .next/cache/\*
 
       - name: Upload Assets (develop - R2)
         if: github.base_ref == 'develop'

.github/workflows/set-develop-personhood-env.yml

@@ -0,0 +1,93 @@
+name: Set Develop Personhood Env
+
+on:
+  workflow_dispatch:
+    inputs:
+      enabled:
+        description: 'Enable TW FidO personhood routes on matters.icu'
+        required: true
+        default: 'true'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+      return_proof_input:
+        description: 'Return verifier proof input to the mobile helper'
+        required: true
+        default: 'true'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+      verifier_url:
+        description: 'zkID verifier base URL for matters.icu'
+        required: true
+        type: string
+
+concurrency:
+  group: set-develop-personhood-env
+  cancel-in-progress: false
+
+jobs:
+  set-develop-env:
+    name: Set matters.icu develop personhood env
+    runs-on: ubuntu-latest
+    environment: develop
+    permissions:
+      contents: read
+    steps:
+      - name: Validate input
+        run: |
+          case "${{ inputs.enabled }}" in
+            true|false) ;;
+            *) echo "Unsupported enabled value: ${{ inputs.enabled }}" >&2; exit 1 ;;
+          esac
+
+          case "${{ inputs.return_proof_input }}" in
+            true|false) ;;
+            *) echo "Unsupported return_proof_input value: ${{ inputs.return_proof_input }}" >&2; exit 1 ;;
+          esac
+
+          node -e "const url = new URL(process.argv[1]); if (url.protocol !== 'https:') throw new Error('verifier_url must be https')" "${{ inputs.verifier_url }}"
+
+          if [ -z "${{ secrets.PERSONHOOD_FIDO_SP_SERVICE_ID }}" ]; then
+            echo "Missing PERSONHOOD_FIDO_SP_SERVICE_ID environment secret" >&2
+            exit 1
+          fi
+
+          if [ -z "${{ secrets.PERSONHOOD_FIDO_AES_KEY_BASE64 }}" ]; then
+            echo "Missing PERSONHOOD_FIDO_AES_KEY_BASE64 environment secret" >&2
+            exit 1
+          fi
+
+      - name: Setup AWS
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION_DEV }}
+
+      - name: Update develop Elastic Beanstalk environment
+        run: |
+          aws elasticbeanstalk update-environment \
+            --environment-name "${{ secrets.AWS_EB_ENV_NAME_DEV }}" \
+            --option-settings \
+              Namespace=aws:elasticbeanstalk:application:environment,OptionName=PERSONHOOD_TW_FIDO_ENABLED,Value="${{ inputs.enabled }}" \
+              Namespace=aws:elasticbeanstalk:application:environment,OptionName=PERSONHOOD_TW_FIDO_RETURN_PROOF_INPUT,Value="${{ inputs.return_proof_input }}" \
+              Namespace=aws:elasticbeanstalk:application:environment,OptionName=PERSONHOOD_FIDO_SP_SERVICE_ID,Value="${{ secrets.PERSONHOOD_FIDO_SP_SERVICE_ID }}" \
+              Namespace=aws:elasticbeanstalk:application:environment,OptionName=PERSONHOOD_FIDO_AES_KEY_BASE64,Value="${{ secrets.PERSONHOOD_FIDO_AES_KEY_BASE64 }}" \
+              Namespace=aws:elasticbeanstalk:application:environment,OptionName=PERSONHOOD_VERIFIER_URL,Value="${{ inputs.verifier_url }}" \
+            >/tmp/update-environment.json
+
+      - name: Wait for develop environment
+        run: |
+          aws elasticbeanstalk wait environment-updated \
+            --environment-names "${{ secrets.AWS_EB_ENV_NAME_DEV }}"
+
+      - name: Verify develop setting
+        run: |
+          aws elasticbeanstalk describe-configuration-settings \
+            --application-name matters-stage \
+            --environment-name "${{ secrets.AWS_EB_ENV_NAME_DEV }}" \
+            --query "ConfigurationSettings[0].OptionSettings[?Namespace=='aws:elasticbeanstalk:application:environment' && contains(['PERSONHOOD_TW_FIDO_ENABLED','PERSONHOOD_TW_FIDO_RETURN_PROOF_INPUT','PERSONHOOD_FIDO_SP_SERVICE_ID','PERSONHOOD_VERIFIER_URL'], OptionName)].{OptionName:OptionName,Value:Value}" \
+            --output table

README.md

@@ -48,7 +48,9 @@
 
 ## Testing
 
-See [Playwright Testing Guide](https://www.notion.so/matterslab/Playwright-Testing-Guide-60caa248d5ce4d70938b7b2f2c7e9139).
+See [E2E Release Evaluation](docs/e2e-release-evaluation.md) for the repo-local Playwright and release-gate guide.
+
+The older Notion guide is still useful for background context: [Playwright Testing Guide](https://www.notion.so/matterslab/Playwright-Testing-Guide-60caa248d5ce4d70938b7b2f2c7e9139).
 
 ## Conventions
 

configs/csp.ts

@@ -13,8 +13,21 @@ export const SENTRY_CSP_REPORT_GROUP = 'csp-endpoint'
 
 const DEFAULT_SRC = ["'self'", process.env.NEXT_PUBLIC_NEXT_ASSET_DOMAIN]
 
+const getCspHost = (url?: string) => {
+  if (!url) {
+    return undefined
+  }
+
+  try {
+    return new URL(url).hostname
+  } catch {
+    return url
+  }
+}
+
 const SCRIPT_SRC = [
   "'self'",
+  "'wasm-unsafe-eval'",
 
   // Next.js Assets
   process.env.NEXT_PUBLIC_NEXT_ASSET_DOMAIN,
@@ -121,6 +134,8 @@ const CONNECT_SRC = [
 
   // Next.js Assets
   process.env.NEXT_PUBLIC_NEXT_ASSET_DOMAIN,
+  getCspHost(process.env.NEXT_PUBLIC_PERSONHOOD_ASSET_URL),
+  getCspHost(process.env.NEXT_PUBLIC_PERSONHOOD_VERIFIER_URL),
 
   // API
   process.env.NEXT_PUBLIC_API_URL,
@@ -213,6 +228,8 @@ const PREFETCH_SRC = [
   process.env.NEXT_PUBLIC_NEXT_ASSET_DOMAIN,
 ]
 
+const WORKER_SRC = ["'self'", 'blob:']
+
 export const CSP_POLICY = Object.entries({
   'default-src': DEFAULT_SRC,
   'script-src': SCRIPT_SRC,
@@ -223,6 +240,7 @@ export const CSP_POLICY = Object.entries({
   'connect-src': CONNECT_SRC,
   'frame-src': FRAME_SRC,
   'prefetch-src': PREFETCH_SRC,
+  'worker-src': WORKER_SRC,
   'report-uri': SENTRY_REPORT_URI,
   'report-to': SENTRY_CSP_REPORT_GROUP,
 })